SOCRadar reports a French supermarket cyberattack and exposed Danfoss OT behind the food supply.
SOCRadar published an analysis of a cyberattack on French supermarket operations and the operational-technology exposure behind France’s food supply. The article’s sections cover what happened, Danfoss systems and what is known about a related vulnerability, and an exposure snapshot of Danfoss StoreView in France. It also frames the incident as hybrid pressure on French infrastructure and lists recommendations for retail and OT operators. The captured text does not name a specific retailer, CVE, threat actor, or quantified impact.
SOCRadar reports a cyberattack affecting French supermarket operations.
The piece focuses on exposed operational technology in the food supply.
Danfoss systems and StoreView exposure in France are specifically examined.
The available text gives no CVE IDs, victim names, or record counts.
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply
Oct 13, 2026
14 Mins Read
Summarize with:
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply
Supermarkets across France opened on Monday, October 12, to warm freezers and spoiled stock. Overnight, attackers had taken control of refrigeration controllers in hundreds of stores and forced them into defrost, heating equipment to as high as 50°C. Prosecutors confirmed fires, retailers estimated losses in the tens of millions of euros, and Coopérative U’s chief executive called the attack unprecedented.
The incident brings a long-discussed Operational Technology (OT) risk into the food supply chain. The affected controllers are mostly end-of-life Danfoss units that no longer receive updates, and passive analysis of internet scan data shows thousands of the same management interfaces still reachable from the internet in France. The attack also lands in a week of active hacktivist pressure on French organizations, though no group has claimed it.
Key Takeaways
Attack: Overnight from October 11 to 12, 2026, attackers forced refrigeration controllers in hundreds of French supermarkets into defrost mode, heating fridges and freezers to as high as 50°C
Victims: Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc stores were hit, and the Paris prosecutor’s office opened an investigation
Vendor: Danfoss named its end-of-life AK-SM 800 and AK-SC 355 controllers, which no longer receive security updates, and said some current AK-SM 800A units on outdated firmware were also hit
Official response: CERT-FR issued an alert on October 12 telling operators to disconnect AK-SM and AK-SC controllers or tightly filter access to them
Attribution: No group has claimed the attack, and neither French authorities nor Danfoss has said who carried it out or how the attackers got in
Exposure: SOCRadar found 2,898 Shodan results for Danfoss StoreView interfaces in France on October 13, about 65% of the global total
Hacktivist pressure: Pro-Russian hacktivist group NoName057(16) continues its long-running #OpFrance DDoS campaign this week and claims to have manipulated a small French hydroelectric plant; nothing links it to the supermarket attack
At a Glance
Attribute
Detail
Date
Night of October 11 to 12, 2026
Affected chains
Intermarché, Netto, Coopérative U (Super U, Hyper U), Carrefour, Monoprix, E.Leclerc
Reported store counts
Intermarché and Netto about 150 to at least 300 depending on source
Affected equipment
Danfoss AK-SM 800 and AK-SC 355 (end of life); some AK-SM 800A units on outdated firmware
Impact
Forced defrost up to 50°C, discarded fresh and frozen stock, equipment starting to catch fire
Estimated losses
Tens of millions of euros across France (Les Mousquetaires)
Intrusion method
Not disclosed
Claim of responsibility
None as of October 13
Official response
Paris prosecutor’s inquiry led by OFAC; CERT-FR alert CERTFR-2026-ALE-012
What Happened in the French Supermarket Cyberattack
Attackers remotely triggered forced defrost cycles on supermarket refrigeration systems across France overnight from Sunday, October 11, to Monday, October 12. A spokesman for Les Mousquetaires, owner of Intermarché and Netto, told Bloomberg that fridges and freezers heated to 50°C for around six hours.
Affected stores had to discard all fresh and frozen products. The Paris prosecutor’s office described a large-scale attack on connected refrigerators at several major food retailers, causing food losses and fires.
The financial impact is significant:
Les Mousquetaires: CEO Thierry Cotillard told BFMTV he expected losses of tens of millions of euros across France
Haguenau, Alsace: BFMTV reported that one Intermarché and one Super U store alone lost €270,000 in merchandise
Retailers framed the incident as a supplier compromise. Les Mousquetaires said the systems were under Danfoss’s management and that filing a complaint would fall to the supplier. E.Leclerc said a cyberattack had affected one of its refrigeration equipment suppliers. Coopérative U CEO Dominique Schelcher called the attack unprecedented and unacceptable.
The impact extended beyond France. Spain, Portugal, Poland, Germany and Belgium were also affected.
Danfoss Systems Involved and What Is Known About the Vulnerability
Danfoss named two affected models: the AK-SM 800, declared end of life in May 2021, and the AK-SC 355, phased out in 2016. Neither receives software or security updates. Some units of the current AK-SM 800A were also hit, and Danfoss said those were running outdated firmware without naming the versions. The company described the incidents as affecting a limited number of refrigeration management systems.
Four further points are on record:
CERT-FR alert: On October 12, CERT-FR, part of ANSSI, said it was aware of numerous compromises affecting Danfoss AK-SM and AK-SC controllers and told operators to disconnect them or filter access in its alert
ANSSI: A person close to Prime Minister Sébastien Lecornu said France’s cybersecurity agency had identified a vulnerability in software supplied by a Danish company and contacted the vendor
No intrusion path named: As of October 13, neither CERT-FR nor Danfoss had named a vulnerability, CVE or way in, and Danfoss’s security advisories page listed no advisory about the attack
Prior Research on Danfoss Controllers
In August 2026, Claroty Team82 disclosed three vulnerabilities in the newer Danfoss AK-SM 800A system manager in its research:
Nginx configuration injection, leading to denial of service
5.4
R4.3.1
Danfoss covered the flaws in DSA-2025-03-01 and DSA-2025-08-01 and advises AK-SM 800A operators to keep firmware up to date.
No authority or vendor has linked these CVEs to the incident. Claroty’s testing covered only the AK-SM 800A, not the two end-of-life models Danfoss named. The research does show that thousands of these management interfaces were reachable from the internet well before the attack.
These controllers have been attacked before. Danfoss’s October 2025 newsletter records attacks on AK-SM 800 systems at 16 Russian supermarkets and 40 Israeli stores in 2022, and notes that all 40 Israeli sites lacked proper firewall or VPN protection.
SOCRadar Exposure Snapshot: Danfoss StoreView in France
Thousands of Danfoss refrigeration management interfaces in France remained reachable from the internet more than a day after the attack. Searching Shodan for the Danfoss StoreView page title, the interface title Claroty highlighted in its August research, SOCRadar found 2,898 results in France, about 65% of the 4,481 found worldwide.
Exposed Danfoss StoreView interfaces by country on Shodan, October 13, 2026
Censys returned 881 unique hosts in France for the same fingerprint. The two figures measure different things: Shodan counts service banners, so one device answering on several ports counts more than once, while Censys counts hosts. A fair range is roughly 900 exposed devices and 2,900 exposed services.
The country distribution overlaps with the spillover reported. Portugal, Belgium and Poland are among the five countries with the most exposed interfaces, though exposure alone does not confirm compromise.
Exposure is not evidence of how this attack happened. The figures come from passive internet scanning data only, and may cover several AK-SM generations under the same page title.
Hybrid Threat: Pressure on French Infrastructure
The supermarket attack remains unattributed, and nothing in the public record ties it to a state or hacktivist actor. It does, however, land in a week of sharp escalation against digital infrastructure in the Russia-Ukraine war and sustained pro-Russian hacktivist activity against France. Read together, these developments offer useful context for defenders, even where no direct link exists.
Digital Infrastructure, Kinetic Strike
Between October 8 and 11, Ukrainian drone strikes hit three Yandex data centers in Sasovo, Kaluga and Vladimir, taking Yandex Cloud and Yandex Pay offline across parts of Russia. Reuters described the first strike as the first major attack on a Russian data hub, following a wave of Russian strikes on Ukrainian data centers.
These were kinetic attacks with no cyber component reported. They matter here because they mark data and cloud infrastructure as legitimate military targets in the conflict. Historically, pro-Russian hacktivist groups have answered symbolic losses with retaliatory campaigns against countries supporting Ukraine, and France is among the most visible of them.
NoName057(16) and the #OpFrance Campaign
Pro-Russian hacktivist group NoName057(16) has targeted French organizations persistently since it emerged in March 2022, and #OpFrance is a recurring campaign for the group. Its posts this week carry the hashtags #OpFrance, #TimeOfRetribution and #FuckEastwood. The table below covers a sample of its most recent claims from its English-language Telegram channel, and none of them mentions the supermarket attack.
The #FuckEastwood hashtag refers to Operation Eastwood, the July 2025 international operation against NoName057(16) coordinated by Europol and Eurojust, which took more than 100 systems offline. The group stayed active after it.
Date
Claimed target
Sector
Claim type
October 13
City of Brest
Local government
DDoS
October 13
Gaztransport et Technigaz (GTT)
LNG storage and transport
DDoS
October 13
Eurenco
Defense, explosives and propellants
DDoS
October 13
GICAT
Defense industry association
DDoS
October 12
SAGEM
Defense and electronics
DDoS
October 12
France’s national payment system
Finance
DDoS
October 12
Haute-Saône prefecture, Vienne and Gers departments
Local government
DDoS
October 11
Small hydroelectric power plant (unnamed)
Energy
Claimed HMI manipulation
The DDoS posts follow the group’s usual format, citing check-host.net reports as proof. Several note targets as “closed by geo,” likely meaning the sites were restricting access by geography. These reports show reachability at a moment in time and do not confirm meaningful disruption.
NoName057(16) post claiming DDoS attacks on Brest, GTT, Eurenco and GICAT, October 13, 2026
The Hydroelectric Plant Claim
The most notable recent post claims “full control” of a small French hydroelectric plant’s control system through a Weintek industrial HMI. The group says it gained access to settings including pool levels, turbines, valves and oil systems, and that “volunteers of the DDoSia Project” switched the system to manual mode and changed parameters, triggering protection systems and alarms. It published a video of an HMI screen as evidence.
NoName057(16) post claiming manipulation of a small French hydroelectric plant through a Weintek HMI
This claim is unverified. No operator or authority has confirmed an incident, and the plant is not named. Pro-Russian hacktivist groups have increasingly posted HMI tampering claims against small, internet-exposed industrial sites, and such claims often overstate impact.
SOCRadar Assessment
The points below are analytical judgments, offered to help defenders prioritize. None of them attributes the supermarket attack.
Target selection follows strategic priorities: This week’s claimed targets cluster around France’s defense-industrial base (Eurenco, GICAT, SAGEM), energy (GTT, the hydroelectric plant) and state services, which matches the group’s long-standing focus on countries supporting Ukraine
Physical effects are the new signaling currency: Whether or not the hydroelectric claim holds up, the group is presenting itself as able to touch physical processes, a step beyond its DDoS core; the supermarket attack showed how much disruption real access to exposed OT can cause
Ambiguity serves hybrid objectives: An unattributed attack on food supply, surrounded by hacktivist claims that French infrastructure is vulnerable, erodes public confidence regardless of who is responsible; the hydroelectric post itself closes by saying French critical infrastructure “has once again demonstrated its vulnerability”
Opportunistic claims are likely: A hacktivist group may claim the supermarket attack in the coming days to borrow its impact, and any such claim should be weighed against technical evidence before it is accepted
Insights and Open Questions
Less than two days in, the attack raises more questions than the public record answers. These are the ones that matter most for defenders and for how the incident is read.
How Did the Attackers Reach the Controllers?
Retailers describe a supplier-side incident, and the controllers are typically managed remotely by refrigeration maintenance firms. At the same time, thousands of StoreView interfaces remain directly reachable online, and CERT-FR’s alert warns against that exposure without saying it was the route. A compromised contractor or vendor management channel would expose every customer on that channel at once, while direct exploitation of exposed devices would point to opportunistic mass targeting.
Was France the Target, or the Largest Pool of Exposed Devices?
France accounts for about two thirds of the StoreView results SOCRadar found on Shodan worldwide. An attack sweeping a vendor’s installed base would hit France hardest by default, so the geographic concentration alone says little about intent. Sekoia’s report of victims in five other countries fits that reading, pending confirmation.
What Was the Goal?
None of the reporting so far mentions a ransom demand or data theft. Heating equipment to 50°C causes physical and financial damage with no direct payoff to the attacker, which fits sabotage or disruption more closely than financially motivated crime.
Will Anyone Claim It?
Hacktivist groups, including NoName057(16), are active against French targets this week, and claims sometimes appear days after an impact. A claim alone would not prove responsibility, since these groups regularly take credit for incidents they did not cause.
Why Were End-of-Life Controllers Still Online?
Danfoss declared the AK-SM 800 end of life in May 2021 and phased out the AK-SC 355 in 2016, and says it long advised supermarkets to move off those models. Both were still running in French stores years later. Refrigeration systems are often installed and maintained by third-party contractors, which leaves a gap between vendor guidance and what actually runs on the shop floor.
Is Food Supply Now an Established Target?
EU food and agriculture commissioner Christophe Hansen said the exploitation of food had become a reality. Whoever is behind this attack has shown that store-level refrigeration can be disrupted at national scale in a single night, and others will have noticed.
Recommendations for Retail and OT Operators
Operators of refrigeration controllers and other building or process systems should treat their management interfaces as critical assets this week:
Follow the CERT-FR alert: Disconnect Danfoss AK-SM and AK-SC controllers from the internet or filter access tightly, limiting remote administration to trusted IP addresses as a first step
Treat exposed units as possibly compromised: CERT-FR advises limiting network access to service providers, factory resetting the device, applying available fixes, changing its secrets, checking accounts and reconfiguring it completely
Replace end-of-life models: The AK-SM 800 and AK-SC 355 receive no fixes, so they need compensating controls now and a replacement date
Update the AK-SM 800A: Move to the latest firmware package Danfoss lists, which was 5.3.x on October 13; systems on 3.x must step through 4.x first
Review contractor access: Audit which refrigeration contractors and service providers hold remote access, rotate their credentials and route them through a single managed entry point
Close adjacent services: Check for VNC, RDP or other remote access services exposed on the same hosts or networks
Add independent temperature alarms: A compromised controller can misreport conditions, so out-of-band sensors provide a second source of truth
Monitor for claims: Watch Dark Web forums and hacktivist Telegram channels for claims naming your organization, suppliers or sector
Frequently Asked Questions
Who Is Behind the French Supermarket Cyberattack?
No group has claimed the attack as of October 13, 2026. Neither French authorities nor Danfoss has named a suspect or disclosed how the attackers reached the refrigeration controllers.
Did NoName057(16) Claim the Supermarket Attack?
No.NoName057(16) has claimed DDoS attacks on French targets and an intrusion at a small hydroelectric plant in recent days, as part of a campaign against France that predates this week, but its posts do not mention the supermarket attack.
Which Supermarkets Were Affected?
Intermarché and Netto, Coopérative U (Super U, Hyper U), Carrefour, Monoprix and E.Leclerc reported affected stores. Intermarché and Netto were hit hardest, with reported counts from about 150 to at least 300 stores, followed by Coopérative U and Carrefour with 80 each.
Which Danfoss Systems Were Affected?
Danfoss named the AK-SM 800 and AK-SC 355, both end-of-life models that no longer receive software or security updates. Some current AK-SM 800A units running outdated firmware were also hit.
Were the Claroty-Disclosed Danfoss Vulnerabilities Used in the Attack?
There is no confirmation. CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 affect the AK-SM 800A, Claroty’s research did not cover the two end-of-life models Danfoss named, and no authority or vendor has linked the flaws to this incident.
How Many Danfoss Controllers Are Exposed in France?
On October 13, 2026, SOCRadar found 2,898 Danfoss StoreView results in France on Shodan and 881 unique hosts on Censys. France accounts for about 65% of exposed StoreView interfaces worldwide.
Were Countries Other Than France Affected?
Sekoia analyst Felix Aime said Spain, Portugal, Poland, Germany and Belgium were also affected. Retailers in those countries had not confirmed incidents at the time of writing.
What Should Refrigeration System Operators Do Now?
Follow CERT-FR’s alert: disconnect AK-SM and AK-SC controllers from the internet or filter access tightly, treat exposed units as possibly compromised, replace end-of-life models, audit contractor remote access and add independent temperature alarms.
Share :
We value your privacy
We use cookies to improve your experience, analyze traffic, and personalize content. You can accept all or customize your preferences.
Accept All Reject All
Manage your cookie preferences
Select which types of cookies you allow. You can update these at any time.
Essential Cookies
Required for the website to function properly, including security, login, and saving consent preferences
[x]
Analytics Cookies
Collect anonymous data to help us understand how visitors use the website and improve content and usability.
[x]
Functional Cookies
Enable enhanced features such as remembering preferences, interactive tools, and other functionality improvements.
[x]
Personalisation Cookies
Allow the site to tailor content and recommendations based on user interactions without collecting personal information.
[x]
Optimisation Cookies
Help us test and improve site speed, layout, and overall performance for a better user experience.
[x]
Save Preferences Accept All
Subscribe to our newsletter and stay updated on the latest insights!
PROTECTION OF PERSONAL DATA****COOKIE POLICY FOR THE INTERNET SITE
Protecting your personal data is one of the core principles of our organization, SOCRadar, which operates the internet site (www.socradar.com). This Cookie Usage Policy (“Policy”) explains the types of cookies used and the conditions under which they are used to all website visitors and users.
Cookies are small text files stored on your computer or mobile device by the websites you visit.
Cookies are commonly used to provide you with a personalized experience while using a website, enhance the services offered, and improve your overall browsing experience, contributing to ease of use while navigating a website. If you prefer not to use cookies, you can delete or block them through your browser settings. However, please be aware that this may affect your usage of our website. Unless you change your cookie settings in your browser, we will assume that you accept the use of cookies on this site.
1. WHAT KIND OF DATA IS PROCESSED IN COOKIES?
Cookies on websites collect data related to your browsing and usage preferences on the device you use to visit the site, depending on their type. This data includes information about the pages you access, the services and products you explore, your preferred language choice, and other preferences.
2. WHAT ARE COOKIES AND WHAT ARE THEIR PURPOSES?
Cookies are small text files stored on your device or web server by the websites you visit through your browsers. These small text files, containing your preferred language and other settings, help us remember your preferences on your next visit and assist us in making improvements to our services to enhance your experience on the site. This way, you can have a better and more personalized user experience on your next visit.
The main purposes of using cookies on our Internet Site are as follows:
Improve the functionality and performance of the website to enhance the services provided to you,
Enhance and introduce new features to the Internet Site and customize the provided features based on your preferences,
Ensure legal and commercial security for the Internet Site, yourself, and the Organization, and prevent fraudulent transactions through the Site,
Fulfill legal and contractual obligations, including those arising from Law No. 5651 on the Regulation of Publications on the Internet and the Fight Against Crimes Committed Through These Publications, as well as the Regulation on the Procedures and Principles Regarding the Regulation of Publications on the Internet.
3. TYPES OF COOKIES USED ON OUR INTERNET SITE****3.1. Session Cookies
Session cookies ensure the smooth operation of the internet site during your visit. They are used for purposes such as ensuring the security and continuity of our sites and your visits. Session cookies are temporary cookies and are deleted when you close your browser; they are not permanent.
3.2. Persistent Cookies
These cookies are used to remember your preferences and are stored on your device through browsers. Persistent cookies remain stored on your device even after you close your browser or restart your computer. These cookies are stored in your browser’s subfolders until deleted from your browser’s settings. Some types of persistent cookies can be used to provide personalized recommendations based on your usage purposes.
With persistent cookies, when you revisit our website with the same device, the website checks if a cookie created by our website exists on your device. If so, it is understood that you have visited the site before, and the content to be presented to you is determined accordingly, offering you a better service.
3.3. Mandatory/Technical Cookies
Mandatory cookies are essential for the proper functioning of the visited internet site. The purpose of these cookies is to provide necessary services by ensuring the operation of the site. For example, they allow access to secure sections of the internet site, use of its features, and navigation.
3.4. Analytical Cookies
These cookies gather information about how the website is used, the frequency and number of visits, and show how visitors navigate to the site. The purpose of using these cookies is to improve the operation of the site, increase its performance, and determine general trend directions. They do not contain data that can identify visitors. For example, they show the number of error messages displayed or the most visited pages.
3.5. Functional Cookies
Functional cookies remember the choices made by visitors within the site and recall them during the next visit. The purpose of these cookies is to provide ease of use to visitors. For example, they prevent the need to re-enter the user’s password on each page visited by the site user.
3.6. Targeting/Advertising Cookies
They measure the effectiveness of advertisements shown to visitors and calculate how many times ads are displayed. The purpose of these cookies is to present personalized advertisements to visitors based on their interests.
Similarly, they determine the specific interests of visitors’ navigation and present appropriate content. For example, they prevent the same advertisement from being shown again to the visitor in a short period.
4. HOW TO MANAGE COOKIE PREFERENCES?
To change your preferences regarding the use of cookies, block or delete cookies, you only need to change your browser settings.
Many browsers offer options to accept or reject cookies, only accept certain types of cookies, or receive notifications from the browser when a website requests to store cookies on your device.
Also, it is possible to delete previously saved cookies from your browser.
If you disable or reject cookies, you may need to manually adjust some preferences, and certain features and services on the website may not work properly as we will not be able to recognize and associate with your account. You can change your browser settings by clicking on the relevant link from the table below.
5. EFFECTIVE DATE OF THE INTERNET SITE PRIVACY POLICY
The Internet Site Privacy Policy is dated The effective date of the Policy will be updated if the entire Policy or specific sections are renewed. The Privacy Policy is published on the Organization’s website (www.socradar.com) and made accessible to relevant individuals upon request.
SOCRadar
Address: 651 N Broad St, Suite 205 Middletown, DE 19709 USA
Phone: +1 (571) 249-4598
Email: [email protected]
Website: www.socradar.com
Extended Threat Intelligence Threat intelligence enriched with External Attack Surface Management, Brand Protection, and Dark Web Radar. Explore XTIAgentic Threat Intelligence Stay ahead of cybercriminals with AI agents that autonomously think, adapt, and act. Explore ATI Advanced Dark Web Monitoring
Dark Web Report
